1. CVE-Search
  2. CVE-2018-9057
ID CVE-2018-9057
Summary aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password.
References
Vulnerable Configurations
  • cpe:2.3:a:hashicorp:terraform:0.1.0:*:*:*:*:aws:*:*
    cpe:2.3:a:hashicorp:terraform:0.1.0:*:*:*:*:aws:*:*
  • cpe:2.3:a:hashicorp:terraform:0.1.1:*:*:*:*:aws:*:*
    cpe:2.3:a:hashicorp:terraform:0.1.1:*:*:*:*:aws:*:*
  • cpe:2.3:a:hashicorp:terraform:0.1.2:*:*:*:*:aws:*:*
    cpe:2.3:a:hashicorp:terraform:0.1.2:*:*:*:*:aws:*:*
  • cpe:2.3:a:hashicorp:terraform:0.1.3:*:*:*:*:aws:*:*
    cpe:2.3:a:hashicorp:terraform:0.1.3:*:*:*:*:aws:*:*
  • cpe:2.3:a:hashicorp:terraform:0.1.4:*:*:*:*:aws:*:*
    cpe:2.3:a:hashicorp:terraform:0.1.4:*:*:*:*:aws:*:*
  • cpe:2.3:a:hashicorp:terraform:1.0.0:*:*:*:*:aws:*:*
    cpe:2.3:a:hashicorp:terraform:1.0.0:*:*:*:*:aws:*:*
  • cpe:2.3:a:hashicorp:terraform:1.1.0:*:*:*:*:aws:*:*
    cpe:2.3:a:hashicorp:terraform:1.1.0:*:*:*:*:aws:*:*
  • cpe:2.3:a:hashicorp:terraform:1.2.0:*:*:*:*:aws:*:*
    cpe:2.3:a:hashicorp:terraform:1.2.0:*:*:*:*:aws:*:*
  • cpe:2.3:a:hashicorp:terraform:1.3.0:*:*:*:*:aws:*:*
    cpe:2.3:a:hashicorp:terraform:1.3.0:*:*:*:*:aws:*:*
  • cpe:2.3:a:hashicorp:terraform:1.3.1:*:*:*:*:aws:*:*
    cpe:2.3:a:hashicorp:terraform:1.3.1:*:*:*:*:aws:*:*
  • cpe:2.3:a:hashicorp:terraform:1.4.0:*:*:*:*:aws:*:*
    cpe:2.3:a:hashicorp:terraform:1.4.0:*:*:*:*:aws:*:*
  • cpe:2.3:a:hashicorp:terraform:1.5.0:*:*:*:*:aws:*:*
    cpe:2.3:a:hashicorp:terraform:1.5.0:*:*:*:*:aws:*:*
  • cpe:2.3:a:hashicorp:terraform:1.6.0:*:*:*:*:aws:*:*
    cpe:2.3:a:hashicorp:terraform:1.6.0:*:*:*:*:aws:*:*
  • cpe:2.3:a:hashicorp:terraform:1.7.0:*:*:*:*:aws:*:*
    cpe:2.3:a:hashicorp:terraform:1.7.0:*:*:*:*:aws:*:*
  • cpe:2.3:a:hashicorp:terraform:1.7.1:*:*:*:*:aws:*:*
    cpe:2.3:a:hashicorp:terraform:1.7.1:*:*:*:*:aws:*:*
  • cpe:2.3:a:hashicorp:terraform:1.8.0:*:*:*:*:aws:*:*
    cpe:2.3:a:hashicorp:terraform:1.8.0:*:*:*:*:aws:*:*
  • cpe:2.3:a:hashicorp:terraform:1.9.0:*:*:*:*:aws:*:*
    cpe:2.3:a:hashicorp:terraform:1.9.0:*:*:*:*:aws:*:*
  • cpe:2.3:a:hashicorp:terraform:1.10.0:*:*:*:*:aws:*:*
    cpe:2.3:a:hashicorp:terraform:1.10.0:*:*:*:*:aws:*:*
  • cpe:2.3:a:hashicorp:terraform:1.11.0:*:*:*:*:aws:*:*
    cpe:2.3:a:hashicorp:terraform:1.11.0:*:*:*:*:aws:*:*
  • cpe:2.3:a:hashicorp:terraform:1.12.0:*:*:*:*:aws:*:*
    cpe:2.3:a:hashicorp:terraform:1.12.0:*:*:*:*:aws:*:*
CVSS
Base: 5.0 (as of 24-04-2018 - 12:08)
Impact:
Exploitability:
CWE CWE-332
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:N/A:N
refmap via4
misc https://github.com/terraform-providers/terraform-provider-aws/pull/3934
Last major update 24-04-2018 - 12:08
Published 27-03-2018 - 18:29
Last modified 24-04-2018 - 12:08
Back to Top